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REMARKS 

The speclScation has been amended. Claims 1, 4 - 5, 9 - 10, 12 - 13, 16 - 17, 21 - 22, 24 

- 25, 28 - 29, 33 - 34, and 36 have been amended. Claims 37 - 38 have been added. No new 
matter has been introduced with these amendments or added claims, wMch are supported in the 
specification as originally filed. Claims 2 - 3, 6 - 8, 14 - 15, 18 - 20, 26 - 27, and 30 - 32 have 
been cancelled from the qjpUcation without prejudice. Claims 1,4-5, 9-13, J6-1 7, 21 -25, 28 

- 29, and 33 - 38 are now in the application. 

L Rejection Under 35 U.S,C. SlG3fa^ 

Paragr^h 3 of the OfBce Action dated Fdnuary 10, 2005 (hereinafter, '^e Office 
Action'') states that Clauos 1 - 8, 10 - 20, 22 - 32, and 34 - 46 are rejected under 35 U-S.C. 
§103(a) as beii^ ui^)a1entable over U. S. Patent 5,862,323 to Blakley et al, in view of U. 
Patent 6,615,258 to Barry et al. Paragr^h 4 of the OfiRce Action states that Claims 9, 21, and 33 
are rejected under 35 U.S.C. §103(a) as being unpatentable over Blakley in view of Barry and 
further in n view of U Patent 6,240,1 84 to Huynh et al. Claims 2 - 3, 6 - 8, 14 - 15, 1 8 - 20. 
26 - 27, and 30 - 32 have been cancelled jOrom the application without prejudice, rendering the 
r^'ections moot as to those claims. The rejections aie respectfully traversed with regard to 
remaining Claims 1, 4 - 5, 9 - 13, 16 - 17, 21 -25, 28 - 29, and 33 - 36. 

Applicants have amended their independent Claims 1,13, and 25 herein to more clearly 
specify that a password synchronization agent, or "PSA", receives " a password pix)pagation 
reque^ providing an identifier of the user [froiri. whom llie request is received] and an. idezitifying 
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secret of the usei^ (Claim 1 , lines 10 - 1 1, emphasis added). Blakley fails to teach this limitation, 
and thus fails to teach responsive limitatioiis (Le., "forwarding ... the received user identifier and 
identifying secret ..." etc.) as specified in Applicants' independent claitns. 

By contrast. Blakley teaches (in a first of two q>proaches) a propagation request 

processing technique that is initiated from a "foreign registry". Blakley refers to this technique as 

a"puir technique, and Blakley^s Fig. 4 illustrates diis technique. As shown therein, the 

processing hegins at Block 424, where a foreign registry **Z" requests a copy of client "W"s 

password. Following this flow through to Block 448, Blakley's password synchromzation server 

''retrieves client W's (password] from the [password] repository and decrvirts if ^ (emphasis 

added). Tliis decrypted passwrd is then returned to foreign registry Z k Notably, 

the password repository (shown as element 112 in Fig. 3B) stores passwords in recoverabjg form 

- that is, a form from which the decrypted version can be recovered. See col 8, lines 40 - 44, 

which discuss the operations of Blocks 448 and 452 (misstated in line 43 as Block 450). See 

also coL 1 1, lines 38 - 4L stating 

"... the password sytitchxonization server supports plain-text password 
^^eval by a foTcign registry upon foreign registry request This operation is also 
called ''password synchronization pull.** (emphasis added) 

Furthennore, col. 16, lines 26 - 27 specify 'Toreign registries will "pulP* a recoverable 
plain-text password when needed ..." (emphasis added). See also coL 1 1, lines 59 - 60, "... the 
password synchronizadon server recovers olaintext passwords from disk storage'' (emphasis 
added). 

Serial No. 09/613,983 -15- Docket RSW9-2000-OO44-US1 
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This is distinct from Applicants' claimed technique, wbich specifies a master registry that 
stones identifying secrets for user identifiers only as secured, non-recoverable versions 
theteor (see lines 15 - 1 6 of Claim 1 , emphasis added). 

It is to be fiirther noted that the target of the propagation, when using BIakley*s *"piiir 
tedtnique, is the same foreign registrv from winch the request was received. And, BIakley*s pull 
technique propagates infixmation recovered from the password synchrcMiization server (col. 1 1 , 
lines 59 - 60). By contrast, ^^Tplicants* claim limitations specify receiving the propagation 
request from a client device (Claim 1, line 8) and then propagating infonnation provided therein 
to target repstries (Claim 1, lines 22 - 24). 

In summary, receiving a request from a foreign registry, and retrieving and decrypting a 
password for propagating to that requesting foreign registry, as taught by Blakley for his pull 
technique^ is patentably distinct from Applicants' claimed technique by virtue of (at least) the 
following limitations! 

"... receiving, ... from a user al a client device a password propagation request 
providing an identifier of the user and an identifying secret of the user"' (Claim 1, 
lines 7-11^ emphasis added); 

"... wherein the trusted master registry stores identifyirig secrets for user 
identifiers only as secured, non-recoverable versions thereoP (Claim 1, lines 15 - 
16, emphasis added); and 

" « propagating ftie received user identifier and identiiying secret ... to one or 
Serial No. 09/61 3,983 -1 6- Docket RSW9-2000-0044-US1 
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more target registries (Claim 1 , lines 22 - 28, emphasis added). 

Thus, it can be seen that Applicants' claimed invention is patentably distinct from 
Bkkley's '*pull*' technique. 

In a second a^^roach^ Blakley specijfies a "push" technique. However, Blakley 's 
disclosed ''push'* technique (which is illustrated in Figs- 3C and 5) ot^tates responsive to a user 
requesting to iqiitjially set or update his/her password. See, for example, the text in Block 510, 
where the processing flow of Fig. S begins, stating *'Client Y requests account cteation or 
password change ..." (emphasis added). Sec also col. 8, lines 45 - 48, stating automatically 
propagate password changes for selected users (accounts) to one ot more foreign registries 
ncQuiring this data" (emphasis added) and lines 57 - 59, stating the client of Y first requests 
account crea tion or a password chang e (emphasis added). 

This "push" approach is also distinct ftom Applicants' claimed invention. In particular, 
since Blakley's "client Y" has now provided a new or different password for this the password 
push technique, the processing that is perfbmied to determine whether this new/different 
password can be propagated involves checking attributes of potential targets and a password 
propagate flag ("P W_PROPAGATE_ENABLE"), but notably, docs not involve a trusted master 
registiy creating a validation result that indicates ^J^iether the trusted master regishy itself "had 
previously stored, for the user identifier, a secured version of tjjs identifying secret" (see 
Applicants' Claim 1 , lines 18-21, emphasis added) that was provided on a request received fiom 
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a user (Claim 1, lines 10-1 1). 

As demonstrated above, ApjAicants respectfully submit that their independent Claims 1 , 
13, and 25 contain a number of limitations not taught by Blakley. Bany also foils to teach these 
limitations: the cited text ftom Blakley simply refers io validating a user's password and 
counting the number of retry attemi^s that are allowed before concluding that the user*s 
password cannot be successfully validated. Huynh also feils to teach the limitations discussed 
above. Indqpendent Claims 1, 1 3, and 25 are therefore deemed patentable over the xefeiences. 
Dependent Claims 4 - 5, 9 - 12, 16 - 1 7, 21 - 24, 28 ^ 29, and 33 - 36 are therefore deemed 
patentable over the references as well. Accordingly, Applicants respectfully request that the 
Examiner withdraw the § 1 03 rejection. 

in. Conclusion 

Applicants respectfully request reconsideradon of the pending rejated claims, 
withdrawal of all presently outstanding rejections, and allowance of all remaining claims at an 
eariy date. 



Respectfully submitted, 




Maabia L. Doubet 
Attorney for Applicants 
Reg. No- 40,999 
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